EUVD-2026-56900
GHSA-wg82-w434-qwgq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible federation API requires authenticated low-privilege access; AC:H reflects cache-timing race condition; confidentiality-only impact with no data modification or service disruption.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.
AnalysisAI
Bearer token reuse in the acm-search-v2-api-rhel9 component of Red Hat Advanced Cluster Management exposes federated hub search results to unauthorized authenticated users. The getFederationConfig cache refresh incorrectly retains one user's token and applies it to all subsequent federated queries until TTL expiry, enabling cross-tenant information disclosure across remote managed hubs. No public exploit has been identified at time of analysis, and the CVSS High Confidentiality rating is tempered by the AC:H timing dependency required for successful exploitation.
Technical ContextAI
The affected component is acm-search-v2-api-rhel9, the search federation API for Red Hat Advanced Cluster Management for Kubernetes (RHACM), which aggregates and proxies search queries across multiple managed hub clusters. The getFederationConfig function maintains an in-memory cache of federation configuration and credentials. CWE-266 (Incorrect Privilege Assignment) describes the root cause: upon cache refresh, the function incorrectly binds one authenticated user's bearer token as a shared credential for all subsequent federated outbound requests - regardless of which user initiated the query - until the cache entry expires. This violates per-request credential isolation, a fundamental requirement when brokering requests across trust boundaries in a multi-tenant Kubernetes management plane. No CPE strings were provided in the input; exact affected version ranges should be confirmed via the Red Hat advisory.
Affected ProductsAI
The affected product is acm-search-v2-api-rhel9, a component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) packaged for RHEL 9. No CPE strings or explicit version ranges were included in the provided input data; affected version information should be verified directly via the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-71468 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2512147. The vulnerability is relevant only to deployments utilizing federated multi-hub search topology.
RemediationAI
Apply the vendor-released patch for acm-search-v2-api-rhel9 once available per the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-71468; no specific fixed version number was confirmed in the provided input data and the exact patched release must be obtained directly from Red Hat. As a compensating control pending a patch, administrators should consider disabling or restricting the federated search feature across managed hubs, which eliminates the vulnerable code path entirely but removes cross-cluster search capability - a significant functional trade-off in multi-hub RHACM deployments. Additionally, restricting API access to the minimum necessary set of authenticated users reduces the population that could exploit the token reuse window. Monitor https://bugzilla.redhat.com/show_bug.cgi?id=2512147 for patch availability and additional technical detail from Red Hat.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today